A new Linux cryptomining campaign has surfaced using a rare trick to stay hidden inside compromised networks.
Instead of behaving like typical malware, the operators turned a trusted Linux security feature into a tool for covering their tracks. This let them mine Monero cryptocurrency while dodging alerts that usually expose intruders.
The attack began in May 2026 when threat actors slipped into a target network through a trusted third party connection.
Once inside, they escalated access to root, the highest level of control on a Linux system. Rather than acting openly as root, which triggers alarms in most security operations centers, the attackers chose a subtler path.
They weaponized the Pluggable Authentication Modules framework, known as PAM, to hop between low privileged accounts without needing passwords.
This scattered activity across accounts that rarely draw attention, creating what researchers describe as a forensic smokescreen.
Analysts from Group-IB identified this technique, noting it allowed the botnet to regenerate even after the root compromise was cleaned up.
The payload is a heavily modified version of the open source XMRig miner, rebuilt to erase its own footprint the moment it starts running.
Group-IB said in a report shared with Cyber Security News (CSN) that it deletes its binary from disk while continuing to operate from memory, leaving little behind for antivirus tools to catch.
Combined with disabled logging and tampered authentication records, the malware effectively blinded file based monitoring.
The campaign highlights a pattern where cryptomining operators borrow tradecraft once reserved for advanced threat actors.
Supply chain trust, memory resident execution, and disguised traffic point to an operation built for longevity. Reviewing trends in recent ransomware attack analysis offers useful context for spotting similar techniques early.
Linux Cryptomining Campaign Weaponizes PAM
The core of this campaign’s stealth lies in how it abuses the pam_rootok policy inside the PAM authentication stack. After gaining root access, the attacker used the standard su command to impersonate low privileged users without entering passwords.
This spread malicious cronjob persistence across unmonitored accounts, so remediating just the root compromise would not stop the botnet from reappearing.
To make detection harder, the operators stopped core logging services and altered authentication logs on compromised hosts. This left almost no forensic trail on disk, blinding tools that depend on log files rather than live memory analysis.
Teams investigating similar breaches benefit from studying recent Linux privilege escalation flaws, since many attacks build on weaknesses in authentication components.
The implant, based on XMRig version 6.25.0 and cross compiled with musl libc, contains a hardcoded banner reading “PRIVATE VERSION FOR BOTNET”.
It creates a mutex file at /tmp/.lock to prevent multiple copies from competing for system resources.
Immediately after, the malware unlinks itself from the file system, deleting its own binary while continuing to run purely from memory.
This fileless approach means disk scans return clean results even while the miner works in the background. It also examines the host’s CPU layout, spawning worker threads and adjusting kernel settings for maximum mining performance.
Custom Features and Evasion Tactics
This variant swaps the standard XMRig command interface for simplified custom flags built for scripted deployment across many machines.
One flag lets the malware spoof legitimate process names such as ssh, blending into normal activity under standard process monitoring tools. Another disables automatic cronjob installation, giving operators finer control over persistence.
The malware supports RandomX, CryptoNight, and Argon2 algorithm variants, letting operators pivot toward whichever cryptocurrency proves most profitable.
Deep binary analysis uncovered layered XOR encryption protecting internal configuration, with keys labeled I3F0 and CLIENT decoding pool connection details.
Decoded credentials tied the operation to a campaign researchers labeled V25 Generation 26, suggesting a system tracking thousands of infected endpoints.
The traffic to the mining pool was disguised using a fake Java Agent user agent string, helping Stratum traffic blend into ordinary web requests.
This mirrors tactics in other Linux malware exploiting misconfigurations, where attackers disguise malicious connections as legitimate traffic.
Recommendations center on strengthening visibility rather than static scans. Organizations should audit and restrict trusted third party access using zero trust principles, while monitoring for unauthorized changes to logging services like rsyslog and auditd.
Teams should watch PAM and audit logs for unusual user switching, since rapid transitions from root into standard accounts can signal this tactic.
Memory forensics remains essential for catching self deleting implants, and reviewing guidance on backdoors abusing PAM frameworks helps teams spot related warning signs.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
